skills-manager-cli 2026.8.26-1

package/dist/dashboard/server/skill-file.js

@@ -0,0 +1,129 @@
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { NodeFileSystem } from '../../infra/fs-skill-home.js';
+import { errorMessage, SkillsManagerError } from '../../shared/errors.js';
+import { assertPathInside, assertSafeSkillName } from '../../shared/validation.js';
+import { highlightSource, renderMarkdown, stripFrontmatter } from './render-markdown.js';
+export const PREVIEW_MAX_BYTES = 512 * 1024;
+/** Whitelisted source-language extensions → shiki grammar (spec §渲染管线). */
+const SOURCE_EXTENSIONS = {
+    js: 'javascript', mjs: 'javascript', cjs: 'javascript',
+    ts: 'typescript',
+    py: 'python',
+    vue: 'vue',
+    sh: 'shellscript', bash: 'shellscript',
+    json: 'json',
+    yaml: 'yaml', yml: 'yaml',
+    toml: 'toml',
+    html: 'html',
+    css: 'css',
+    xml: 'xml',
+    sql: 'sql',
+};
+/** Binary by content, not by name: a NUL byte or undecodable UTF-8. */
+function isBinary(buffer) {
+    if (buffer.includes(0))
+        return true;
+    try {
+        new TextDecoder('utf-8', { fatal: true }).decode(buffer);
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+function extensionOf(relativePath) {
+    const base = relativePath.split('/').pop() ?? '';
+    const dot = base.lastIndexOf('.');
+    return dot > 0 ? base.slice(dot + 1).toLowerCase() : '';
+}
+const fs = new NodeFileSystem();
+function forbidden(code, message) {
+    return Object.assign(new SkillsManagerError(code, message), { statusCode: 403 });
+}
+function notFound(code, message) {
+    return Object.assign(new SkillsManagerError(code, message), { statusCode: 404 });
+}
+/** Shared safety gate for both preview endpoints: valid name + existing skill.
+ *  403 invalid_skill_name / 404 skill_not_found, mirroring the hub's posture. */
+export function previewSkillDir(home, name) {
+    try {
+        assertSafeSkillName(name);
+    }
+    catch (error) {
+        throw forbidden('invalid_skill_name', errorMessage(error));
+    }
+    const skillDir = path.join(path.resolve(home, 'skills'), name);
+    if (fs.kind(path.join(skillDir, 'SKILL.md')) !== 'file') {
+        throw notFound('skill_not_found', `Skill not found: ${name}`);
+    }
+    return skillDir;
+}
+/** File entries for the preview tree: sorted relative paths + sizes. Broken
+ *  symlinks report size 0 — the tree reflects the directory as it stands. */
+export function previewFileEntries(skillDir, paths) {
+    return paths.map((relative) => {
+        let size = 0;
+        try {
+            size = statSync(path.join(skillDir, relative)).size;
+        }
+        catch {
+            size = 0;
+        }
+        return { path: relative, size };
+    });
+}
+/** Read one file of a hub skill for the preview Sheet (read-only).
+ *  Security: skill name validation + path containment on both the lexical and
+ *  the real (symlink-resolved) path — same posture as the rest of the hub. */
+export async function readSkillFile(home, name, relativePath) {
+    const skillDir = previewSkillDir(home, name);
+    const absolute = path.resolve(skillDir, relativePath);
+    try {
+        assertPathInside(absolute, skillDir);
+    }
+    catch (error) {
+        throw forbidden('path_escape', errorMessage(error));
+    }
+    let realFile;
+    try {
+        realFile = realpathSync(absolute);
+    }
+    catch {
+        throw notFound('file_not_found', `File not found: ${name}/${relativePath}`);
+    }
+    try {
+        assertPathInside(realFile, realpathSync(skillDir));
+    }
+    catch {
+        throw forbidden('path_escape', `Symlink escape blocked: ${name}/${relativePath}`);
+    }
+    if (fs.targetKind(realFile) !== 'file') {
+        throw notFound('file_not_found', `File not found: ${name}/${relativePath}`);
+    }
+    const buffer = readFileSync(realFile);
+    if (isBinary(buffer)) {
+        return { kind: 'binary', size: buffer.length };
+    }
+    const truncated = buffer.length > PREVIEW_MAX_BYTES;
+    const content = (truncated ? buffer.subarray(0, PREVIEW_MAX_BYTES) : buffer).toString('utf8');
+    const extension = extensionOf(relativePath);
+    if (extension === 'md') {
+        return {
+            kind: 'markdown',
+            html: await renderMarkdown(stripFrontmatter(content)),
+            raw: content,
+            truncated,
+        };
+    }
+    const sourceLang = SOURCE_EXTENSIONS[extension];
+    if (sourceLang) {
+        return {
+            kind: 'source',
+            html: await highlightSource(content, sourceLang),
+            truncated,
+        };
+    }
+    return { kind: 'text', raw: content, truncated };
+}
+//# sourceMappingURL=skill-file.js.map

package/dist/dashboard/server/skill-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-file.js","sourceRoot":"","sources":["../../../src/dashboard/server/skill-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,iBAAiB,GAA2B;IAChD,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY;IACtD,EAAE,EAAE,YAAY;IAChB,EAAE,EAAE,QAAQ;IACZ,GAAG,EAAE,KAAK;IACV,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa;IACtC,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;IACzB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,uEAAuE;AACvE,SAAS,QAAQ,CAAC,MAAc;IAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,YAAoB;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,EAAE,GAAG,IAAI,cAAc,EAAE,CAAC;AAEhC,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe;IAC7C,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;AACnF,CAAC;AAED;iFACiF;AACjF,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACxD,IAAI,CAAC;QACH,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,oBAAoB,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACxD,MAAM,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,KAAe;IAClE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;8EAE8E;AAC9E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,YAAoB;IAClF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,IAAI,IAAI,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC;QACH,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,CAAC,aAAa,EAAE,2BAA2B,IAAI,IAAI,YAAY,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,IAAI,IAAI,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAEtC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,QAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,iBAAiB,CAAC;IACpD,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAE5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,UAAmB;YACzB,IAAI,EAAE,MAAM,cAAc,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACrD,GAAG,EAAE,OAAO;YACZ,SAAS;SACV,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,QAAiB;YACvB,IAAI,EAAE,MAAM,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC;YAChD,SAAS;SACV,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC5D,CAAC"}